auth-eng-holds-com[.]pages[.]dev

The domain auth‑eng‑holds‑com.pages.dev was registered on 24 Oct 2025 through Cloudflare, Inc. As of 12 Jul 2026 the site remains active and returns HTTP 500 responses, with the page title “Worker threw exception | auth‑eng‑holds‑com.pages.dev | Cloudflare”. The service is identified as a brand‑impersonation campaign targeting Cloudflare, and the risk rating is high. The host resolves to 188.114.96.3, an address owned by AS13335 Cloudflare, Inc. and geolocated to the United States. Authoritative nameservers are kenneth.ns.cloudflare.com and tessa.ns.cloudflare.com, both operated by Cloudflare. The TLS certificate is issued by Google Trust Services under the WE1 label, indicating a legitimate‑looking HTTPS endpoint. Detected technologies include HSTS and HTTP/3, consistent with a standard Cloudflare front‑end. Google Safe Browsing has flagged the domain for SOCIAL_ENGINEERING, and VirusTotal records show 12 of 95 security vendors marking the domain as malicious. The site appears on a single security blocklist, PhishDestroy, and receives a Gridinsoft trust score of 0 / 100, reinforcing the malicious assessment. The combination of a Cloudflare‑styled page title, a valid certificate, and the brand‑impersonation narrative suggests an attempt to lure victims into believing they are interacting with an official Cloudflare service. Defenders should block DNS resolution to 188.114.96.3 for the affected domain, add auth‑eng‑holds‑com.pages.dev to URL filtering policies, and monitor outbound traffic for attempts to contact the host. Incident response teams should treat any credential submission to this site as compromised, enforce password resets for affected accounts, and consider threat‑intel sharing with upstream providers. Ongoing surveillance of Cloudflare‑issued subdomains is advised, as the infrastructure can be rapidly re‑used for additional impersonation campaigns.